Does the Android OS always ask a user to review an application's permissions if it is not downloaded from the Android marketplace directly? For instance, downloading an application from a non-Google Android marketplace or directly from a website or computer. I could not find any information about this If so, please provide a documented occurrence or source.

1 Answer
1

No, or at least not in a way that can't be automated away. Titanium Backup can install apps without the user seeing this prompt, for example. It may require root to do this.

Without root, only the system can access the areas needed to install apps. So barring any bugs, apps can only be installed by the system and the system will show the permissions if the Market has not already. I don't have documentation of this, but the source code is freely available :P

Edit: Eldarerathis points out the AOSP security page, which indicates that the permissions dialog will be presented on app install, although adb install does not require this (presumably because you have physical access to the device in that case). This is also confirmed by another official resource that sbaskin89 found.

I tried posting an answer to my own question but am not allowed to do so due to user restrictions. Here was what I was going to post: Unless someone else has tested/experimented with this, I have found this under the [Android Developers Resource][1] stating that > Applications statically declare the permissions they require, and the Android system prompts the user for consent at the time the application is installed. [1]: developer.android.com/guide/topics/security/security.html
–
baskinomicsNov 4 '11 at 23:23

@ Matthew Read Thanks for the answer, I should have clarified that I was asking in the context of non-rooted phones. This question is relevant to a research paper I am writing.
–
baskinomicsNov 4 '11 at 23:25

1

It's documented on the AOSP security page that a dialog will be presented (barring root access like Titanium, though I don't know specifically how it dodges it). However adb install also subverts the permission system and does not require root.
–
eldarerathis♦Nov 4 '11 at 23:26

It is the same functionality as hitting "Run" as an "Android Application" in Eclipse I believe, something the OS must recognize. The link you gave states exactly the information I was looking for under the section heading How Users Understand Third-Party Applications.
–
baskinomicsNov 4 '11 at 23:39

1

I would guess Titanium uses something like pm install <someFile>.apk which will not display the permissions, but requires root.
–
CatShoesApr 3 '13 at 15:28